Repository navigation
fix: renew authn's own client certificate and clamp the login JWT to it - #76
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment Thanks for integrating Codecov - We've got you covered ☂️ |
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Debian 11 LTS ended 2026-08-31; its security pool no longer serves the .deb files its index advertises, so apt-get install fails in CI. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 of 5 tasks
braghettos
pushed a commit
to krateo-platformops/authn
that referenced
this pull request
Oct 29, 2026
…it (#28) Port of krateoplatformops#76 (5088c74), which never reached this repo. authn-clientconfig was written once at boot and never renewed, so a pod that outlived its certificate failed every RESTAction call with an x509 expiry. The signer may also grant much less than requested (OpenShift: 720h cap, 30-day CA rotation). - Read the granted NotAfter and record it as authn.krateo.io/certificate-not-{before,after} Secret annotations; warn when the grant is under 90% of the request. - Renew authn-clientconfig in the background (internal/certrenewal) at AUTHN_CRT_RENEWAL_THRESHOLD of the granted lifetime. - Clamp every login JWT to its certificate's real NotAfter (encode.tokenDuration). Adapted to this repo: - go/authn layout and krateo-platformops module paths - RS256 signing: Extras keeps JwtPrivateKey/JwtKeyID and adds CertNotAfter - the clamp also covers the serviceaccount strategy, which #76 predates - knobs in chart values and schema - docs/certificate-renewal.md replaces #76's README section; architecture, behavior, configuration, gotchas, index, llms.txt and log are updated - #76's CI and Dockerfile changes are dropped, since main already supersedes them - the verify script's stale --wait description is corrected Co-authored-by: EdmondDantes21 <redi.vreto@krateo.io> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ
braghettos
added a commit
to krateo-platformops/authn
that referenced
this pull request
Oct 29, 2026
…it (#28) (#40) * fix: renew authn's own client certificate and clamp the login JWT to it (#28) Port of krateoplatformops#76 (5088c74), which never reached this repo. authn-clientconfig was written once at boot and never renewed, so a pod that outlived its certificate failed every RESTAction call with an x509 expiry. The signer may also grant much less than requested (OpenShift: 720h cap, 30-day CA rotation). - Read the granted NotAfter and record it as authn.krateo.io/certificate-not-{before,after} Secret annotations; warn when the grant is under 90% of the request. - Renew authn-clientconfig in the background (internal/certrenewal) at AUTHN_CRT_RENEWAL_THRESHOLD of the granted lifetime. - Clamp every login JWT to its certificate's real NotAfter (encode.tokenDuration). Adapted to this repo: - go/authn layout and krateo-platformops module paths - RS256 signing: Extras keeps JwtPrivateKey/JwtKeyID and adds CertNotAfter - the clamp also covers the serviceaccount strategy, which #76 predates - knobs in chart values and schema - docs/certificate-renewal.md replaces #76's README section; architecture, behavior, configuration, gotchas, index, llms.txt and log are updated - #76's CI and Dockerfile changes are dropped, since main already supersedes them - the verify script's stale --wait description is corrected Co-authored-by: EdmondDantes21 <redi.vreto@krateo.io> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ * docs: certificate-renewal doc type Architecture; drop dead-org reference from log Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ * fix(scripts): pin C locale in verify-cert-renewal.sh openssl prints English month names and date(1) parses %b in the current locale, so under any non-English locale (e.g. it_IT on macOS) the granted-window parse failed and the script aborted. Found running the script against a kind cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ * docs(design): JWT lifetime is clamped to the certificate's granted NotAfter (#28) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ * fix(scripts): verify the renewed certificate against the current context's apiserver The Secret's server-url is the in-cluster address consumers use (chart default https://kubernetes.default.svc), which does not resolve from a workstation, so step 3 always failed off-cluster. What is under test is the client certificate: present it to the current context's apiserver, trusting that context's CA. Also print sub-hour grants in minutes instead of "0h". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ --------- Co-authored-by: Redi Vreto <104623303+EdmondDantes21@users.noreply.github.com> Co-authored-by: EdmondDantes21 <redi.vreto@krateo.io> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
authn-clientconfigwas written once, at startup, and never renewed. A pod outliving its certificate kept presenting an expired one and every RESTAction call to snowplow failed withx509: certificate has expireduntil someone restarted it. The signer grantsmin(requested, --cluster-signing-duration, signer CA remaining life)— OpenShift pins the middle term to 720h and rotates its signer CA every 30 days, so the year we ask for can come back as a day.authn.krateo.io/certificate-not-{before,after}andwarnwhen it is under 90% of what was requested.authn-clientconfigin the background (internal/certrenewal): issue at startup, re-issue once the certificate passesAUTHN_CRT_RENEWAL_THRESHOLDof its granted lifetime. The certificate is read once per issuance and the loop sleeps straight to the due point — a year-long certificate is one ~8-month sleep, not a poll.NotAfterinencode.Success, so a session can no longer outlive the credential it authenticates with. This is what makes per-user<user>-clientconfigSecrets not need a renewal loop; the reasoning is in the README.AUTHN_SERVICE_CRT_EXPIRES_IN(the 8760h that was hardcoded inmain.go),AUTHN_CRT_RENEWAL_THRESHOLD,AUTHN_CRT_RENEWAL_ENABLED.get+updateon secrets authn already holds, so no chart change is required to ship this.scripts/verify-cert-renewal.shautomates the three checks that have to be measured per distribution (granted window, renewal fires before expiry, apiserver still accepts the renewed certificate).Verification
Unit tests cover the renewal policy, certificate parsing and the clamp. Verified end to end on kind: 7 consecutive renewals at a 10m TTL, each firing ~9 minutes before its own expiry, each renewed certificate accepted by the apiserver as
authn/[authn system:authenticated], exactly one CSR object throughout, and a real login returning a 23h54m57s token against a 24h request.kind honours
spec.expirationSecondsin full, so a capped signer is still unexercised — OpenShift, minikube, k3s, EKS, AKS and GKE remain unverified.